It would be great to have a proper flag to disable the HTML web view (relevant for private newsletters using WYSIJA). In the mean time, I implemented is_user_logged_in() on controllers/front/email.php to intervene and serve a 404 template for non-logged-in users.